PT-2012-5270 · Tcexam · Tcexam

Published 2012-08-20 · Updated 2012-09-11 · CVE-2012-4238

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TCExam versions prior to 11.3.008

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with level 5 or greater permissions to inject arbitrary web script or HTML via the question subject id parameter in the /admin/code/tce edit answer.php endpoint.

Recommendations For versions prior to 11.3.008, update to version 11.3.008 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-4238

Affected Products

Tcexam

References · 7

• 🔥 http://reactionpenetrationtesting.co.uk/tcexam-cross-site-scripting.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-08/0090.html · Exploit
• http://secunia.com/advisories/50141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4238 · Security Note
• http://freecode.com/projects/tcexam/releases/347125 · Note
• http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4238 · Note